Back

Phishing Psychology: How to Resist Scammers

Any phishing attack is based on methods of psychological influence on a person. Regardless of the technical implementation, the scammers always try to get the victim to perform the required action - click on a link, download and run a malicious attachment, enter confidential data or transfer money. And what is more, a person will be wound up to a condition where all actions are done in the heat of the moment, so that the scheme will work out in the best way.

What Is Social Engineering?

In information security, social engineering refers to a set of manipulative methods and techniques used to influence an individual in order to obtain their personal data and confidential information. Essentially, it is a body of knowledge from sociology and psychology that allows you to predict and manage people's behavior by playing on their emotions, feelings, fears and reflexes.

Curiosity, greed, pity and fear are the main feelings and emotions that fraudsters use to capture the victim's attention and disable the objective and logical perception of reality. By adding factors such as urgency, irritation or authority, they enhance the effect of strong emotion and lack of attention. "Everything was as in a fog ", "I didn't realize how it happened", "I did everything automatically" - this is how victims of phishing attacks most often recall their actions, complaining of a state close to affect.

What Do Fraudsters Play On?

Curiosity. These are various messages that intrigue the recipient and arouse their interest in what is hidden in the link: "Want to know more?", "Isn't that you in the picture?", "I have a unique offer for you".

Greed. These are various messages about prizes and benefits, fueled by the urgency effect. Discounts, promotions, sweepstakes and winnings that have found you and are valid only now - you only need to follow the link, log in, enter your bank card details for crediting. Also promises of big money for easy work.

Pity. One of the most insidious scams is based on a desire to help: "We need to raise money for an operation", "Help the shelter survive", "Help us win the competition", etc.

Fear. This motive is very often combined with the factor of authority and urgency, e.g. letters from government organizations or messages from the boss asking the recipient to do something urgently, even to prevent a disaster: "Immediately pay the fine", "Urgently transfer money to the company account", "Urgently study the document in the attachment", etc. This is how endless scams work, with warnings about fines, taxes, debts, personal accounts, etc.

How to Recognize Phishing?

In addition to the main technical attributes of phishing attacks - imitation of sender names, style and design, presence of a link or attachment - you should always critically evaluate the content and psychological impact of the message:

What emotion does it make me feel?
Is there an emphasis on urgency?
Why am I being asked to take a particular action?
Should I click on the link or open the document?

Before taking any action requested by the message, answer these questions for yourself and, if in doubt, take a break and think about how you can verify the information you've received. For example, is it possible to contact the sender in another way, such as by phone, to verify that they have really written to you; or by going to the company's official website to verify the terms of the promotion or the reason for the alert?

Phishing is essentially a mass mailing, and attackers use themes in their messages that can be understood and applied to a large number of people. Where there is mass demand and hype, there are more opportunities for fraud. Therefore, the best way to protect yourself from scams is to be vigilant and alert.

Targeted Attacks

Another key psychological trick used by fraudsters is the principle of trust based on knowledge. Scammers prepare carefully for targeted attacks: they gather information from open sources and personalize their messages for each new victim to make them as believable as possible. So, if a letter addresses you by your first name and surname, and includes personal details such as your email address, phone number or home address, do not believe everything it says.

If a suspicious message comes from your friend, colleague or boss on a social network or messenger, remember that attackers can either hack or clone their account. Don't rush to reply and or take any action mentioned in the message. Better, call or write to this person in another messenger to find out all the details.

How Not to Fall for Scammers' Tricks:

The most important thing is to critically evaluate any information you receive. If you have doubts, if you feel rushed by the urgency of the decision - take a pause, do not rush to answer. Remember that the first sign of a scammer is their persistence.

Check the sender and the information you have received by any alternative means, verify all details using other sources.

Stay up to date with the latest news on popular scams and follow simple cyber hygiene rules. Recommendations on how to protect yourself online can be found in the official Security communities on the VKontakte social network and in the VK About Security channel on the Zen platform, or Security is OK on the Odnoklassniki social network.